The NSA’s phone records program is over. But that doesn’t mean the data it collected is gone.

The government on Sunday ended a National Security Agency program that collected the phone records of millions of Americans thanks to the USA Freedom Act. But there are a few reasons it's unclear how much of the data is still in government hands -- and how long it will stay there.

The USA Freedom Act, passed by Congress in June, called for an end to the government's collection of the phone records after a six-month transition period and the creation of a replacement system where the government must obtain a court order to get phone companies to hand over information about numbers thought to belong to terrorism suspects.

The act did not specifically require the government to purge the treasure trove of data amassed by the old program, although the government has indicated it planned to "cease" accessing it. But much remains uncertain.

The NSA has requested access to historical phone metadata until Feb. 29, limited to technical personnel and only for the purpose of verifying that the new system is working as intended, according to the Office of the Director of National Intelligence (ODNI). The Foreign Intelligence Surveillance Court is considering the request.

Separately, the ODNI said, the NSA remains under a legal obligation to preserve the phone metadata it has collected until civil litigation regarding the program is resolved or the relevant courts relieve the NSA of such obligations. The NSA and the Justice Department have declined to state whether that means they will preserve all the records or just those that are relevant to the litigation.

The phone records preserved solely for legal obligations will not be used or accessed for any other purpose, officials said, and the NSA will destroy them as soon as possible after the legal obligations end, the ODNI said.

The protective order forcing the government to hang on to at least some of the data is connected to court cases over the legality of the phone program filed by the Electronic Frontier Foundation.

One of the government's arguments in those cases is that such groups need to prove that their plaintiff's data was actually collected as part of the programs to sue over it. That puts privacy advocates in the awkward position of having to make sure that the government doesn't erase data it wishes it had never collected at all because it's evidence needed to keep their court challenges alive.

"We want them to delete it, but not until they confirm that our data was collected," explained Nate Cardozo, a staff attorney at EFF.

Some privacy advocates are also concerned that the government may find ways to get around the privacy protections built into the USA Freedom Act. Even with the law change, Cardozo says it's hard to know what kind of information about domestic phone calls the government may be able to get under other authorities originally designed to target foreign individuals.

That's not much of a stretch: A recent New York Times story reported that the government used such powers to replace a similar program that collected records about Americans' e-mail use.

After details of the e-mail program were disclosed by documents from whistleblower Edward Snowden, the government said it had ended that particular program in 2011. But an Inspector General report obtained by the Times said that among the reasons it was shut down was that "other authorities can satisfy certain foreign intelligence requirements" the e-mail program "had been designed to meet." And because the other methods were ostensibly aimed at foreigners, they have even less judicial oversight than the original e-mail records program.

The whole incident was described by some privacy advocates as a sort of "shell game" that highlighted just how hard it is to track how the U.S. spies on its own people.

While the end of the phone records program is considered a major victory by many privacy advocates, lack of clarity over the fate of the data it collected shows that shedding light on the government's surveillance programs is still an uphill battle.